Cloudflare Free Tier: What's Actually Free (2026)

If you’ve ever hovered over Cloudflare’s signup button and thought “there has to be a catch,” you’re not being cynical — you’re being a developer. The Cloudflare free tier is genuinely free, but it’s a bundle of several different free tiers that each have their own limits, and the limits are where projects actually live or die. This guide walks you through what’s included in 2026, the exact quotas, and — most importantly — what you can and can’t realistically run without paying.

Facts below verified against Cloudflare’s official docs and current third-party breakdowns, as of October 2026.

Table of Contents

First, understand: there is no single “free tier”

Cloudflare isn’t one product. It’s a stack: website protection (DNS, CDN, WAF), the developer platform (Workers, Pages, KV, D1, R2), and Zero Trust networking. Each line has its own free tier with its own quotas. When someone says “Cloudflare is free,” they usually mean the website plan. When they say “the free tier ran out,” they usually mean Workers or KV limits. Keep that separation in your head and everything below makes sense.

The website plan: what’s free for your domain

The Free website plan costs $0/month, forever, and it covers what most small sites actually need: fast DNS, a global CDN, unmetered DDoS protection, a universal SSL certificate, and a free managed WAF ruleset. You also get SSO and role-based account control. For a personal site, a docs portal, or a marketing front end, that’s production-grade delivery at zero cost.

What you don’t get on the free website plan: image optimization (Polish and Mirage), no uptime SLA, community support only, no PCI DSS compliance, and no custom certificates. Free zones also get sampled analytics with roughly a 24-hour retention window in the dashboard — so you can’t see per-path cache hit ratios or debug a cache-miss storm the way a paid plan lets you.

Two catches are worth knowing before you plan around the free website plan:

Edge cache TTL floor. Free zones can’t set an edge cache TTL below two hours via rules. If you’re serving a semi-dynamic feed that changes every few minutes, this matters.
The video/large-file rule. Cloudflare’s Self-Serve agreement restricts using the service primarily to serve video or large non-HTML files. There’s no published gigabyte number, and enforcement is discretionary — historically it arrives as an email asking you to move to Stream, upgrade, or leave. Don’t build a video-heavy project on the free plan hoping nobody notices.

If you need image optimization or better analytics, Pro is $20/month billed annually ($25 monthly). Business ($200/month annual) adds PCI compliance and a 100% uptime SLA. But for most side projects, the free website plan is genuinely all you need.

Workers: the free tier most developers actually touch

Cloudflare Workers is edge compute — serverless functions that run in Cloudflare’s data centers around the world. The free tier is generous on paper and strict in practice:

100,000 requests per day (resets at midnight UTC) — roughly 3 million a month.
10 ms CPU time per invocation. This is the real constraint. Note: this is CPU time, not wall time — waiting on a fetch doesn’t count against it.
128 MB memory per worker.
50 subrequests per invocation — every fetch call or KV/R2/D1 request your worker makes counts, including each step of a redirect chain.
3 MB compressed worker size, up to 100 workers per account, 5 cron triggers.

That 10 ms CPU budget works beautifully for auth endpoints, webhook handlers, URL shorteners, redirect services, and lightweight API gateways. It does not work for endpoints that query a database, process a file, or call several downstream APIs in sequence — those blow past 10 ms and fail. If you exceed the limit, you get a 1101 error, and it can happen silently on complex middleware chains.

The paid Workers plan ($5/month plus usage) raises the CPU limit to 30 seconds per invocation and bumps requests to 10 million/month included — which is when the question stops being “can I run this for free?” and becomes “is this cheaper than a $6 VPS?”

Pages: static hosting with real limits

Cloudflare Pages hosts your frontend — static sites, or edge-rendered frameworks like Next.js. The free tier gives you unlimited sites, unlimited bandwidth, and 500 builds per month with up to 20,000 files per deployment. Compared to Vercel’s Hobby plan, the unlimited bandwidth and lack of a personal-use-only restriction stand out.

The limits that bite you in practice:

1 concurrent build. If you have multiple branches or preview deployments firing at once, a queue forms fast.
20-minute build timeout. A large Next.js project with hundreds of static pages can brush against this.
SSR runs through Workers free limits. Pages uses Workers under the hood for server-side rendering. Every API route, image transform, and revalidation webhook counts against the 100,000/day Workers quota and the 10 ms CPU budget.

KV, D1, and R2: the data layer free tiers

If your edge app needs storage, Cloudflare gives you three free-tier options, and picking the wrong one is the most common free-tier mistake:

Workers KV — 100,000 reads/day, but only 1,000 writes/deletes/lists per day, and 1 GB of storage. Treat KV as scarce capacity: cache reads, never use it as a write log. A single per-article write per event will burn through the daily quota fast.
D1 (SQLite at the edge) — 5,000,000 rows read per day, 100,000 rows written per day, 5 GB total storage. The most generous free database tier you’ll find anywhere; more than enough for most side projects’ real read/write volumes.
R2 (object storage) — 10 GB storage, 1 million Class A operations (writes, lists, deletes) and 10 million Class B operations (reads) per month, with zero egress fees. That’s the headline: S3 charges about $0.09/GB out to the internet. For serving images, PDFs, or build artifacts, R2’s free tier is genuinely hard to beat.

Rule of thumb: D1 for relational data, KV for read-heavy config and caches, R2 for files and assets. And remember D1 and R2 aren’t bundled into Pages — they’re separate free tiers you enable alongside it.

What you can realistically run for free

Let’s make this concrete. Here’s what fits comfortably on the free tier in 2026, and what doesn’t:

Comfortably free

A portfolio, blog, or docs site on Pages with a custom domain, HTTPS, and CDN — costs you $0 forever (plus the domain).
A small API (auth, webhooks, a URL shortener) on Workers doing well under 100k requests/day with sub-10ms CPU per request.
A side project with a D1 database reading a few hundred thousand rows a day and a small user table.
An image or asset pipeline on R2 under 10 GB with modest monthly reads — zero egress means you can actually serve them to visitors, not just store them.

Where free runs out

Video or heavy file serving. The Self-Serve agreement means this is the fastest way to get a “please upgrade or leave” email.
Write-heavy KV usage. 1,000 writes a day is shockingly easy to hit if you use KV as a log or event store.
Compute-heavy Workers. Image processing, PDF generation, or chaining multiple downstream APIs blows the 10 ms CPU budget.
High-volume SSR. Every Next.js API route and revalidation webhook on Pages consumes the same 100k/day Workers budget.

When to pay: the upgrade triggers

You don’t need to memorize the whole pricing page. Just watch for these signals:

You’re hitting Workers limits → Workers Paid ($5/month + usage) gives 10M requests/month and 30 seconds of CPU per invocation.
You need image optimization or better analytics → Pro ($20/month annual) for the website plan.
You need an uptime SLA or PCI compliance → Business ($200/month annual).
You’re serving lots of large files → consider R2 (zero egress) or a paid plan rather than hoping the free tier’s video rule doesn’t apply to you.

The honest verdict: the Cloudflare free tier is one of the few “forever free” offers that isn’t a trial in disguise. The quotas are published, they reset on fixed schedules, and they’re genuinely enough for real projects — as long as you design around the CPU, write, and bandwidth-ish limits instead of discovering them in production. Build with the numbers above in mind, and free stays free.

Cloudflare Free Tier: What’s Actually Free (and the Limits) in 2026